Evaluation of Incremental Backup Copies for Presence of Malicious Codes in Computer Systems

1. A computer having computer-readable program code configured to be executed by a processor of the computer, the computer-readable program code being stored non-transitory in a computer-readable storage medium and comprising: first computer-readable program code for accessing contents of a plurality of snapshots, each snapshot in the plurality of snapshots being an incremental backup of a data storage device and indicating modified sectors of the data storage device of the computer, the modified sectors indicated in each snapshot in the plurality of snapshots containing a portion of a file, each snapshot in the plurality of snapshots containing information on a plurality of files; and second computer-readable program code configured to determine if a modified sector of the data storage device noted in a snapshot in the plurality of snapshots have been modified by malicious code, the modified sector being selected for determination of modification by malicious code based on information from an incremental backup included in the snapshots; wherein the first computer-readable program code selects the snapshot together with a full backup of the data storage device to restore the data storage device based on scanning of the modified sector of the data storage device and corresponding data in the snapshot for malicious codes.

2. The computer of claim 1 wherein the second computer-readable program code comprises a sector scanner configured to scan individual sectors of the data storage device for malicious code.

3. The computer of claim 2 wherein the data storage device comprises a hard disk.

4. The computer of claim 1 further comprising: third computer-readable program code to identify a file associated with a particular modified sector indicated in a particular snapshot in the plurality of snapshots.

5. The computer of claim 4 wherein the second computer-readable program code comprises a file-based antivirus configured to scan the file associated with the particular modified sector indicated in the particular snapshot in the plurality of snapshots.

6. The computer of claim 1 wherein each snapshot in the plurality of snapshots is created using a copy-on-write backup procedure and contains differential data of modified sectors.